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MONITORIN vTAND AUTOMATIC NOTIFICATION OF IRREGULAR 
ACTIVITY IN A NETWORK-BASED TRANSACTION FACILITY 



FIELD OF THE INVENTION 

The present invention relates generally to the field of e-commerce and, 
more specifically, to monitoring irregular activity in a network-based transaction 
5 facility such as, for example, an Internet-based auction facility. 

BACKGROUND OF THE INVENTION 

Network-based transaction facilities (e.g., business- to-business, business- 
to-consumer and consumer-to-consumer Internet marketplaces and retailers) 
S 10 provide convenience of access to users of such facilities and on-line communities. 
Si Information regarding sales made through network-based transaction facilities 

:U may be automatically extracted and reported for any desired time interval - 

,ess 

hourly, daily, weekly, monthly, etc. This information is useful to the facilities for 
a variety of reasons including record keeping, generating statistics, calculating 
15 revenue, etc. 

For example, an Internet-based retailer may generate a report listing the 
items sold during the day and the revenue generated by the sales. An Internet- 
based bookstore may, for example, generate reports listing the number of books 
sold during the past month in a specific category or by a specific author. Such 
20 statistics are useful in assisting a purchaser with a buying decision or assisting 
the retailer with stocking decisions. 

For a network-based transaction facility, such as an Internet-based auction 
facility, and its users, information regarding sales is particularly important for 
setting fees and providing price guidance to users. Fees may be set based on 
25 volume or price of the items sold for individual users. The network-based 
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auction facility may use sales information and statistics to determine how to set 
fees. The network-based auction facility may further use information generated 
on a periodic basis to guide sellers in setting prices at which to sell their items or 
buyers in bidding for items by indicating the average price or price range of the 
type of product being sold. Thus, there is a need for accurate reporting of 
information. 



SUMMARY OF THE INVENTION 

A method of filtering out item data in a report in network-based auction 
facilities is described. Data concerning multiple items is received in a database of 
a network-based auction facility. A price-based value is associated with at least 
one item. Irregular data concerning an irregular item having a price-based value 
greater than a predetermined price-based value is removed from a 
representation of the data. 



BRIEF DESCRIPTION OF THE DRAWINGS 

The present invention is illustrated by way of example and not limitation 
in the figures of the accompanying drawings, in which like references indicate 
similar elements and in which: 

Figure 1 is a block diagram illustrating an exemplary network-based 
transaction facility in the form of an Internet-based auction facility; 

Figure 2 is a block diagram illustrating an exemplary database that at least 
partially implements and supports the Internet-based auction facility of Figure 1; 

Figures 3a and 3b are diagrammatic representations of an exemplary 
embodiment of a transaction record table; 

Figure 4 is a flow diagram of one embodiment of an irregular activity 
monitoring and automatic notification system; 

Figure 5 is a flow diagram of a second embodiment of an irregular activity 
monitoring and automatic notification system; 

Figure 6 is a flow diagram of a third embodiment of an irregular activity 
monitoring and automatic notification system; 

Figure 7 is a flow diagram of a fourth embodiment of an irregular activity 
monitoring and automatic notification system; 

Figure 8 is a flow diagram of a fifth embodiment of an irregular activity 
monitoring and automatic notification system; 

Figure 9 is a block diagram of one embodiment of a computer system 
suitable for practicing the present invention. 




DETAILED DESCRIPTION 

A method and system for monitoring and automatically reporting 
irregular activity on a network-based transaction facility are described. In the 
following description, for purposes of explanation, numerous specific details are 
5 set forth in order to provide a thorough understanding of the present invention. 
It will be evident, however, to one skilled in the art that the present invention 
may be practiced without these specific details. 

Terminology 

10 For the purposes of the present specification, the term "transaction" shall 

be taken to include any communications between two or more entities and shall 
■ffi be construed to include, but not be limited to, commercial transactions including 

J\ sale and purchase transactions, auctions and the like. The term "suspect" shall be 

J I taken to indicate requiring further investigation or scrutiny. The term "irregular" 

^ 15 shall be taken to indicate a derivation from a norm or an exceeding of boundaries 

or a range. 

■ia= 
; 

.V* 

;d Transaction Facility 

Figure 1 is a block diagram illustrating an exemplary network-based 
transaction facility in the form of an Internet-based auction facility 10. While an 
20 exemplary embodiment of the present invention is described within the context 
of an auction facility, it will be appreciated by those skilled in the art that the 
invention will find application in many different types of computer-based, and 
network-based, commerce facilities. 

The auction facility 10 includes one or more of a number of types of front- 
25 end servers, namely page servers 12 that deliver web pages (e.g., markup 

language documents), picture servers 14 that dynamically deliver images to be 
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displayed within Web pages, listing servers 16, CGI servers 18 that provide an 
intelligent interface to the back-end of facility 10, and search servers 20 that 
handle search requests to the facility 10. E-mail servers 21 provide, inter alia, 
automated e-mail communications to users of the facility 10. 
5 The back-end servers include a database engine server 22 including an 

irregular activity monitoring system 27, a search index server 24 and a credit 
card database server 26, each of which maintains and facilitates access to a 
respective database. 

The Internet-based auction facility 10 may be accessed by a client program 
10 30, such as a browser (e.g., the Internet Explorer distributed by Microsoft Corp. 
of Redmond, Washington) that executes on a client machine 32 and accesses the 
facility 10 via a network such as, for example, the Internet 34. Other examples of 
networks that a client may utilize to access the auction facility 10 include a wide 
area network (WAN), a local area network (LAN), a wireless network (e.g., a 
15 cellular network), or the Plain Old Telephone Service (POTS) network. 
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Database Structure 



C3 Figure 2 is a database diagram illustrating an exemplary database 23, 

maintained by and accessed via the database engine server 22, which at least 
20 partially implements and supports the auction facility 10. Database engine 
server 22 includes an irregular activity monitoring system 27 which performs 
algorithms to remove irregular and suspect data items from data representations, 
as described below with reference to Figures 4-8. 

The database 23 may, in one embodiment, be implemented as a relational 
25 database, and includes a number of tables having entries, or records, that are 
linked by indices and keys. In an alternative embodiment, the database 23 may 
be implemented as collection of objects in an object-oriented database. 
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Database 23 includes an item table 40, which contains a record for each 
item being auctioned on the auction facility 10. An item record in item table 40 
may include, inter alia, an identification number, a marketplace indicator, sale 
type, title, location, seller, owner, category, quantity, bid count, sale start date, 

5 sale end date, highest bidder identification, billing currency, etc. The database 23 
also includes an item ended table 42, linked to the item table 40, and an item 
archived table 44, linked to the item ended table 42. Each item from item table 40 
is moved to the item ended table 42 two to three days after the end of the auction 
for that item. Each item from item ended table 42 is moved to item archived 

10 table 44 three months after the end of the auction for that item. 

The item table 40 is also linked to item description table 50 and item 
description ended 52. Item description table 50, item description ended table 52 
and item description archived table 54 may each include, inter alia, a description 
of each item in the item table, an identification for the item and a marketplace 

15 indicator for the item. Each item description from item description table 50 is 
moved to the item description ended table 52 two to three days after the end of 



the auction for that item. Each item description from item description ended 

'1 . i 

table 52 is moved to item description archived table 54 three months after the 



end of the auction for that item. 

20 A number of other tables are also shown to be linked to the item table 40, 

namely a transaction record table 200, a categories table 70 and an irregular item 
table 80. The irregular item table 80 may also be linked (not shown) to the 
transaction record table 200. Item information from item records in item table 40 
is entered into transaction record table 200 upon the completion of a successful 

25 auction. 

Figures 3a and 3b are diagrammatic representations of an exemplary 
embodiment of the transaction record table 300 that is populated with records, or 
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entries, for completed, or ended, transactions (e.g., auctions) that have been 
facilitated by the auction facility 10. The table 300 includes an item identifier 
column 310 for each entry, and at least one price-based value column 320, 330 
indicating, for example, the highest bid for the entry (or selling price) 320 or a 
5 fee, based on the highest bid 330, charged the seller by the network-based 
auction site 10. The item identifier entry may be an item number including a 
pointer to further item information in item table 40. The item information in item 
table 40 may include a pointer to category information in categories table 70. 

An irregular flag column 340 stores a value 301-304 indicating whether the 
10 entry is irregular. A seller id column 350 and a bidder id column 360 store a user 
?=3 identifier for each of the seller of an item and the highest bidder (or purchaser) 

for the item, the user identifier comprising a pointer to further user information 
stored in a user table (not shown). 

It should be noted that only one of the selling price column 320 or price- 
;y * 15 based fee column 330 is necessary for the operation of the present invention. 
'Q Further, the irregular flag column 340, seller id column 350 and bidder id column 

H 360 are also not required for the operation of the irregular activity monitoring 

; W 

Q and automatic reporting system. In the embodiment shown in Figures 3a and 3b, 

■«% 

monitoring of the irregular activity is done using the transaction record table 300. 

20 In other embodiments, the irregular activity may be monitored and reported in 
any table that used by the auction site for reporting or representing data. 

In Figures 3a and 3b, items 1-4 in column 310 are linked to the same 
category. The selling prices of items 1-4 are $2500, $150,000, $1800 and $1950, 
respectively. If the category is computers, for example, the category may be 

25 assigned an irregular activity threshold of $15,000 or another amount that would 
indicate that the item or the bid is irregular (or outside the normal range). In 
figure 3a, all of the irregular flag values 301-304 in column 340 are initially 
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assigned a value of 0 when the item information is first entered in the transaction 
record table 300. 

In Figure 3b, item 2's irregular flag 302 has been changed from 0 to 1 to 
indicate that item 2 has some irregular activity associated with it. It should be 
5 noted that, in one embodiment, an entry is only created in the transaction record 
table 300 for transactions that have been established, for example, by the 
conclusion of an auction process, or by some other offer and acceptance 
. mechanism between the purchaser and the seller. Thus, the irregular activity 
monitoring and automatic notification system, which may include changing the 
10 irregular flag value, may be triggered after information has been entered into a 
transaction record table 300, for example, for each category for all auctions in that 
category ending at a specific time. 

The irregular flag may be implemented so that the irregular flag may be 
later changed back to 0, after further investigation. In another embodiment, the 
15 irregular flag may be implemented so that it may not be changed back to 0 once 
it has been changed to 1. 



¥ h When irregular activity has been found, an email may be sent to the seller 

m 

:p and /or bidder at an address associated with the user identifier of the seller 

and/or bidder. The seller and/or bidder may further be banned from 
20 participation on the auction site by using the pointer linking to the user table to 
update a "irregular_user" or similar field in the user record of the seller and/or 
bidder. 

The irregular flag 301-304 in Figures 3a and 3b may be updated based on 
another price-based value, such as a price-based fee 330, for example. An 
25 auction site 10 may charge sellers fees based on the selling price of an item. 
Thus, the auction site may use the formula for determining fees to determine a 
threshold fee for monitoring irregular activity. In Figures 3a and 3b, the 
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threshold fee for the category computers, for example, may be $200, based on a 
threshold price of $15,000. In another embodiment, the threshold fee may be 
simply the average fee plus a set amount, such as $300, for example. Thus, if the 
average fee for computers is $40, for example, then the threshold fee may be 
5 $340. Many other algorithms may be used to determine a threshold price-based 
value, such as a threshold price or threshold price-based fee. 

The threshold price-based value may also be determined based on the 
currency of the transaction, the category of the transaction, or the geographic 
location of the transaction. For example, a table may be used to determine 
10 threshold prices for items where the rows of the table represent the categories of 
O the item and the columns represent the currency of the transaction. The 

threshold values may be listed in U.S. dollars for uniformity. Although the 
transaction is completed in Japanese yen, the threshold value will be listed in 
dollars and the highest bid will be converted from yen to dollars to compare 
15 whether the threshold value has been exceeded. Thus, a transaction completed 
in Japanese yen won't be limited to the threshold set for transactions in U.S. 
dollars and transactions in U.S. dollars won't be limited to thresholds set for 
Japanese yen. 

Figure 4 is a flow diagram of one embodiment of an irregular activity 
20 monitoring and automatic notification system. At processing block 401, data is 
received, for example in the transaction record table 300, having at least one 
price-based value. Although the process is described with respect to transaction 
record table 300, it will be appreciated that the following processes may 
performed with any set of data at any location at auction site 10. 
25 At processing block 402, a counter n is set to 0. At processing block 403, 

the irregular activity monitoring system 27 checks to see if a price-based value of 
Item (n) of a set of items has a value greater than a predetermined value. As 
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discussed above, the set of items may be items from the same category which 
had transactions established, by the ending of an auction, for example, at the 
same time. The predetermined value would depend on which price-based value 
is being examined, the currency, the geographic area, the category of the item or 
any other parameter that may indicate different threshold values to establish 
irregular activity. 

If the price-based value of item(n) is not greater than the predetermined 
value, the irregular activity monitoring system 27 skips to processing block 405, 
as described below. 

If the price-based value of item(n) has a value greater than the 
predetermined value, at processing block 404, the item(n) is removed from 
further representations of the data, which may include, for example, reports or 
statistics based on established transactions. The irregular activity monitoring 
system 27 then proceeds to processing block 405 which checks whether the end 
of the set of items has been reached by comparing n to End. If n equals End, the 
system concludes checking for irregular activity at processing block 407. 

If n does not equal End, the counter is incremented by 1 and the irregular 
activity monitoring system 27 returns to processing block 403 to check then next 
item in the set of items. 

It will be appreciated that the irregular activity monitoring system 27 may 
be implemented as part of a larger application or may be implemented by itself. 

Figure 5 is a flow diagram of a second embodiment of an irregular activity 
monitoring and automatic notification system. At processing block 501, data is 
received including at least one item record having at least one price-based value 
associated with the item, as discussed above with respect to Figure 4. At 
processing block 502, a counter n is set to 0. 

At processing block 503, the price-based value of item(n) of a set of items 
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is compared to a predetermined price-based value. If the price-based value of 
item(n) is not greater than the predetermined value, the irregular activity 
monitoring system 27 goes on to processing block 505. 

If the price-base value of item(n) is greater than the predetermined value, 

5 at processing block 504, the value of an irregular_flag associated with item(n) is 
changed from 0 to 1. The system then proceeds to processing block 505 where 
the system checks to see if the end of the set of items has been reached. If the end 
of the set has not been reached, at processing block 506, the counter n is 
incremented by 1 and the system proceeds to processing block 503 to check the 

10 price-based value of the next item. If the end of the set has been reached, the 
system proceeds to processing block 507 where a report or other data 
representation is generated where the data representation only includes items 
having an irregular flag value of 0. 

Figure 6 is a flow diagram of a third embodiment of an irregular activity 

15 monitoring and automatic notification system. At processing block 601, data is 



^ received including at least one item record having at least one price-based value 

associated with the item, as discussed above with respect to Figure 4. At 
/□ processing block 602, a counter n is set to 0. 

At processing block 603, the price-based value of item(n) of a set of items 
20 is compared to a predetermined price-based value. If the price-based value of 
item(n) is not greater than the predetermined value, the irregular activity 
monitoring system 27 goes on to processing block 605. 

If the price-base value of item(n) is greater than the predetermined value, 
at processing block 604, the value of an irregular_flag associated with item(n) is 
25 changed from 0 to 1. The system then proceeds to processing block 605 where 
the system checks to see if the end of the set of items has been reached. If the end 
of the set has not been reached, at processing block 606, the counter n is 
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incremented by 1 and the system proceeds to processing block 603 to check the 
price-based value of the next item. 

If the end of the set has been reached, the system proceeds to processing 
block 607 where each item having an irregular flag value of 1 is investigated. At 
5 processing block 608, the irregular flag values of all the transactions that are 
found to be legitimate are reset to 0. At processing block 609, a report or other 
data representation is generated where the data representation only includes 
items having an irregular flag value of 0. 

Figure 7 is a flow diagram of a fourth embodiment of an irregular activity 
10 monitoring and automatic notification system. At processing block 701, data is 

r] received including at least one item record having at least one price-based value 

so 

.fn associated with the item. At processing block 702, a counter n is set to 0. 

■01 

At processing block 703, the price-based value of item(n) of a set of items 

1—3. 

;^ is compared to a predetermined price-based value. If the price-based value of 

15 item(n) is not greater than the predetermined value, the irregular activity 
monitoring system 27 goes on to processing block 705. 

If the price-base value of item(n) is greater than the predetermined value, 
at processing block 704, the value of an irregular_flag associated with item(n) is 
changed from 0 to 1. The system then proceeds to processing block 705 where 
20 the system checks to see if the end of the set of items has been reached. If the end 
of the set has not been reached, at processing block 706, the counter n is 
incremented by 1 and the system proceeds to processing block 703 to check the 
price-based value of the next item. 

If the end of the set has been reached, the system proceeds to processing 
25 block 707 where a report or other data representation is generated where the data 
representation includes all items including items having an irregular flag value 
of 1. However, the records for all items having an irregular flag value of 1 are 
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disabled so that the items are not used for any computations or statistics or other 
purposes, although the items appear in the data representations. 

At processing block 708, all items having an irregular flag value of 1 are 
investigated. At processing block 709, the irregular flag values of all the 
5 transactions that are found to be legitimate are reset to 0 so that the item records 
may be included in computations and statistics. 

Figure 8 is a flow diagram of a fifth embodiment of an irregular activity 
monitoring and automatic notification system. At processing block 801, data is 
received including at least one item record having at least one price-based value 
10 associated with the item. At processing block 802, a counter n is set to 0. 
ri At processing block 803, the price-based value of item(n) of a set of items 

Jj^ is compared to a predetermined price-based value. If the price-based value of 

item(n) is not greater than the predetermined value, the irregular activity 
monitoring system 27 goes on to processing block 805. 
15 If the price-base value of item(n) is greater than the predetermined value, 

at processing block 804, the value of an irregular_flag associated with item(n) is 
changed from 0 to 1. The system then proceeds to processing block 805 where 
the system checks to see if the end of the set of items has been reached. If the end 
of the set has not been reached, at processing block 806, the counter n is 
20 incremented by 1 and the system proceeds to processing block 803 to check the 
price-based value of the next item. 

If the end of the set has been reached, the system proceeds to processing 
block 807 where a report or other data representation is generated where the data 
representation only includes items having an irregular flag value of 1. At 
25 processing block 808, all of the items in the report generated by processing block 
807 are investigated. At processing block 809, the irregular flag values of all the 
transactions that are found to be legitimate are reset to 0 so that the item records 
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are available for all computations, statistics, etc. 

In summary, it will be appreciated that the above described interfaces, and 

underlying technologies, provide a convenient vehicle for the inputting of 

feedback, comments or opinions regarding multiple items, or transactions, via a 

single user interface. 

Figure 9 shows a diagrammatic representation of machine in the 
exemplary form of a computer system 900 within which a set of instructions, for 
causing the machine to perform any one of the methodologies discussed above, 
may be executed. In alternative embodiments, the machine may comprise a 
network router, a network switch, a network bridge, Personal Digital Assistant 
(PDA), a cellular telephone, a web appliance or any machine capable of 
executing a sequence of instructions that specify actions to be taken by that 
machine. 

The computer system 900 includes a processor 902, a main memory 904 
and a static memory 906, which communicate with each other via a bus 908. 
The computer system 900 may further include a video display unit 910 (e.g., a 
liquid crystal display (LCD) or a cathode ray rube (CRT)). The computer system 
900 also includes an alpha-numeric input device 912 (e.g. a keyboard), a cursor 
control device 914 (e.g. a mouse), a disk drive unit 916, a signal generation 
device 920 (e.g. a speaker) and a network interface device 922 

The disk drive unit 916 includes a machine-readable medium 924 on 
which is stored a set of instructions (i.e., software) 926 embodying any one, or 
all, of the methodologies described above. The software 926 is also shown to 
reside, completely or at least partially, within the main memory 904 and/ or 
within the processor 902. The software 926 may further be transmitted or 
received via the network interface device 922. For the purposes of this 
specification, the term "machine-readable medium" shall be taken to include any 



-16- 



• 4 

medium that is capable of storing or encoding a sequence of instructions for 
execution by the machine and that cause the machine to perform any one of the 
methodologies of the present invention. The term "machine-readable medium" 
shall accordingly be taken to included, but not be limited to, solid-state 
memories, optical and magnetic disks, and carrier wave signals. 

Thus, a method and system for harvesting feedback information, 
comments, and opinions regarding multiple items from users of a network-based 
transaction facility have been described. Although the present invention has 
been described with reference to specific exemplary embodiments, it will be 
evident that various modifications and changes may be made to these 
embodiments without departing from the broader spirit and scope of the 
invention. Accordingly, the specification and drawings are to be regarded in an 
illustrative rather than a restrictive sense. 
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